Good points. Supposing you're referring to setrlimit/ulimit syscalls for example, do those apply per thread or per process? My understanding is they're per process. Then the math comes down to how many user processes per remote machine can the service run? A few hundred? That's a hard limit on the scalability of the service. Is process really the ideal level of isolation?